Subject: [Sidrops] Alvaro Retana's No Objection on draft-ietf-sidrops-rtr-keying-03: (with COMMENT)

From: Alvaro Retana <[email-masked]>
Date: Wed, 23 Jan 2019 09:46:42 -0800

Alvaro Retana has entered the following ballot position for
draft-ietf-sidrops-rtr-keying-03: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-sidrops-rtr-keying/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

(1) I don't really have a strong objection for this document being a BCP. 
However, while documenting two different methods, there is no clear indication
of "what is believed to be the best" [rfc2026], or even better, which method
should be used in what situations.  I understand that operators have different
preferences/needs and that prescribing one method as the default in not the
right thing to do.

I would really like to see some text (maybe a "Deployment Considerations"
section) that talks about when one or the other might be preferred/considered.

(2) §4: s/BGP Identifier [RFC4271]/BGP Identifier [RFC6286]

(3) §4: "In the case where the operator has chosen not to use unique per-router
certificates, a BGP Identifier of 0 MAY be used." rfc6286 defines the BGP
Identifier as always being non-zero.  rfc8209 says that "if the same
certificate is issued to more than one router (and hence the private key is
shared among these routers), the choice of the router ID used in this name is
at the discretion of the Issuer."  It seems to me that it doesn't matter which
ID is used...it just can't be 0.  The simple fix is to just remove the sentence.

(4) §8: "Enabling the router-to-CA connectivity MAY require connections to
external networks (i.e., through firewalls, NATs, etc.)."  That "MAY" is out of
place because this sentence is just stating a fact.

(5) §8: "Note that the checks performed by the router in Section 7...SHOULD be
performed."  Besides confirming the checks from §7, I'm not sure what this
sentence really contributes...but I do think that the "SHOULD" is out of place
because the Normative language is already in §7.

(6) Nits
s/used by the the/used by the
s/corresponds to the private used/corresponds to the private key used